CVE-2025-59937
go-mail has insufficient address encoding when passing mail addresses to the SMTP client
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée).
Description
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | gitea, gitea-fips, sftpgo | 1.24.6-r1 et 1 autres |
| go::GitHub Security Advisory Go | github.com/wneessen/go-mail | 0.7.1 |
| wolfi | gitea, sftpgo | 1.24.6-r1 et 1 autres |
Afficher les 6 entrées de 3 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | gitea | 1.24.6-r1 |
| chainguard | gitea-fips | 1.24.6-r1 |
| chainguard | sftpgo | 2.6.6-r9 |
| go::GitHub Security Advisory Go | github.com/wneessen/go-mail | 0.7.1 |
| wolfi | gitea | 1.24.6-r1 |
| wolfi | sftpgo | 2.6.6-r9 |
Références
- https://github.com/wneessen/go-mail
- https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479
- https://github.com/wneessen/go-mail/issues/495
- https://github.com/wneessen/go-mail/pull/496
- https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5
- https://nvd.nist.gov/vuln/detail/CVE-2025-59937
- https://pkg.go.dev/vuln/GO-2025-3988